From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934812AbcALKIs (ORCPT ); Tue, 12 Jan 2016 05:08:48 -0500 Received: from mx1.redhat.com ([209.132.183.28]:52520 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934701AbcALKIp (ORCPT ); Tue, 12 Jan 2016 05:08:45 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <1452569755.4776.69.camel@linux.vnet.ibm.com> References: <1452569755.4776.69.camel@linux.vnet.ibm.com> <88773.1452562139@eng-mail01.juniper.net> <1452470153.2651.60.camel@linux.vnet.ibm.com> <2033.1452447990@warthog.procyon.org.uk> <1452432410.2651.40.camel@linux.vnet.ibm.com> <20160106134525.15633.73582.stgit@warthog.procyon.org.uk> <24185.1452126854@warthog.procyon.org.uk> <1452180676.2890.21.camel@linux.vnet.ibm.com> <3384.1452458018@warthog.procyon.org.uk> <27007.1452559481@warthog.procyon.org.uk> <31702.1452564218@warthog.procyon.org.uk> To: Mimi Zohar Cc: dhowells@redhat.com, "Mark D. Baushke" , James Morris , Marcel Holtmann , petkan@mip-labs.com, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <31421.1452593319.1@warthog.procyon.org.uk> Date: Tue, 12 Jan 2016 10:08:39 +0000 Message-ID: <31422.1452593319@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Mimi Zohar wrote: > The IMA MOK and blacklist are restricted to "public_key_restrict_link". > Does this only allow keys signed by keys on the respective keyring or > also by the system keyring? As my patches stand, the following are implemented: (1) public_key_restrict_link() restricts to asymmetric keys that are signed by a CA in the specified keyring. It returns -ENOKEY if no matching key is found rather than -EKEYREJECTED, however, so you can call it several times for different keyrings. -EKEYREJECTED is only returned if a signature check fails. This is used by the following two functions. (2) restrict_link_by_system_trusted() restricts to asymmetric keys that are signed by a CA in the system keyring. This ignores the keyring argument it is given. Note that the system_trusted_keyring is then no longer exported because verify_pkcs7_signature() is also in certs/system_keyring.c and uses that by default if NULL is passed. (3) restrict_link_by_ima_mok() restricts to asymmetric keys signed by a CA in either .system_keyring or .ima_mok. So the trusted keyrings are then restricted as follows: (1) .system_keyring uses restrict_link_by_system_trusted() - though it lacks any sort of write permission, so it's currently moot. It could just as well be replaced with a function that just returns -EPERM. (2) .ima_mok should be using restrict_link_by_system_trusted(), but I failed to update this when I split the public_key_restrict_link() function. I've updated this in my patch. This would then be correct according to Petko's commit log: To successfully import a key into .ima_mok it must be signed by a key which CA is in .system keyring. However, from what Petko says, this is wrong and it should instead be using restrict_link_by_ima_mok(). (3) .ima_blacklist should be using restrict_link_by_system_trusted() also. I've no idea whether additions to this should be permitted by keys in .ima_mok also. (4) .ima uses restrict_link_by_ima_mok(), as per: On turn any key that needs to go in .ima keyring must be signed by CA in either .system or .ima_mok keyrings. (5) .evm is not restricted by my patches. This is a mistake on my part - but I'm not sure what the restriction actually needs to be as it's not mentioned in Petko's commit message. Presumably it needs the same as .ima. David